77cd1002a88ed48117ee416ff476da64e1d186a8b796997880f3da9b1fb7140c

Analysis

max time kernel
134s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 02:54

Target

77cd1002a88ed48117ee416ff476da64e1d186a8b796997880f3da9b1fb7140c.dll
Size

57KB
MD5

b404d23704dddccf2c530d9c14997938
SHA1

5ce400c20c632b19abdc75f29f19185ab5d85da5
SHA256

77cd1002a88ed48117ee416ff476da64e1d186a8b796997880f3da9b1fb7140c
SHA512

3480d7f68077a6f1637775e20d39a267279ed82c9a0467c460fcee0f8ff156e0ff04282628869bf6823b2023ebb5bb1f7f445dae610ec243e22b48c2a4d27312
SSDEEP

1536:kNIKDv4YU6EMyDcqiZZZNihyISFIR6/JP+3CT:5qv4YU6ErtGNEKIpCT

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 5072	1800	rundll32.exe	79
PID 1800 wrote to memory of 5072	1800	rundll32.exe	79
PID 1800 wrote to memory of 5072	1800	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\77cd1002a88ed48117ee416ff476da64e1d186a8b796997880f3da9b1fb7140c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\77cd1002a88ed48117ee416ff476da64e1d186a8b796997880f3da9b1fb7140c.dll,#1
  2⤵
  PID:5072